WinAuth[.]exe[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WinAuth.exe.zip
Size

2.2MB
MD5

7386f23def56fcb09640e3567ade2a9e
SHA1

33af7f39d81e8a9917b3d7d85809766c4261c66e
SHA256

d8decb9f8ea53713e76e4272214320a67e3272d8b64a13e300134943a0d63e03
SHA512

f8346a95f531ffff1f77aa6ba6e165762705da0b1933f3cf46885aa18186765e87d52cc9cc6e223b91d8b68580a26a64370d8fb296d3396099c0f583b8e75ee1
SSDEEP

49152:gdW6eLPdkMAtApeKZ+FdPNXe06rByn41hHDxF64e:gd3eL1k3apGFdPBT6Byn41VDxM4e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/WinAuth.exe

Files

WinAuth.exe.zip
.zip
WinAuth.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
checksums.txt